Ledger confirms hidden chip in crypto wallet amid $92M theft claims

Cytobit

What is the use case of a hardware cryptocurrency wallet besides trapping bitcoins in the Shadow Realm?

chinathrow

Exhibit #9387434 for reasons to stay out of crypto.

ArtTimeInvestor

Hardware wallets are not a solution to self-custody. If one would make a list of things that can go wrong, starting from the supply chain that delivers parts to the manufacturer, malicious employees at the manufacturer, mistakes the manufacturer can make, attacks on the delivery chain from the manufacturer to the user, to mistakes the user can make creating, using and storing their keys - the list would contain hundreds of points.

astverskoy

Crypto is a gift to scammers: billions stolen, victims left with little recourse, and no effective government oversight.

Neywiny

My gut reaction is that a hardware implant would be too costly so there's no way they'd actually do that but I guess when you can steal $92M, anything is possible. They could even fab an esoteric chip and still make a profit.

dauertewigkeit

Funny how all the rules of capitalism break down as you approach really big sums of money.

Freeaqingme

I'm guessing the best way to go about self custody these days is to have a multi sig wallet, based on multiple hardware wallets from different vendors.

whywhywhywhy

Can see why hardware wallets seemed a good idea at the time but history has shown this is a terrible way to self custody. Compromised devices aside, the KYC data leaks have put people in danger too.

jmakov

So HW passkeys in general can also be compromised?

postalcoder

What a f-ing nightmare. It's stuff like this where I start to understand Apple's stance on right to repair. How do you maintain hardware security without strict provenance over every component in your device?

buckle8017

The tweet doesn't say that ledger installed the chip. This is some D grade trash writing.

woadwarrior01

Ledger has had three data leak incidents: once in 2020, a software supply chain attack in 2023 and another data leak in 2026. This latest one is the fourth. Even if one were to ignore the latest incident, which arguably isn't their fault, the first three incidents make up a pretty bad security track record. How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).

olalonde

I wonder if a epoxy/resin potting would solve this sort of attack. Or active tamper response that fries the board if someone tampers with the case.